> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domino.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# "Invalid host" error when trying to connect MiniO server as a Generic S3 data source

> After a Chrome update, Chromium-based browsers rejected  incomplete SSL certificate chain with a NET::ERR_CERT_COMMON_NAME_INVALID error. Fix involved converting the .p7b chain file to PEM using OpenSSL and re-importing it into AWS Certificate Manager

**Version/Environment (if relevant):**

Applies to all version of Domino after browser update.

## Issue:

After a Chrome update, Chromium-based browsers rejected the SSL certificate chain for the deployment, making it unreachable. The following error was displayed in the browser:

```
NET::ERR_CERT_COMMON_NAME_INVALID
```

## Root Cause:

Per AWS documentation, NET::ERR\_CERT\_COMMON\_NAME\_INVALID on an Application Load Balancer can have the following causes:

* The domain name used in the HTTPS request does not match the alternate name specified in the listener's associated AWS Certificate Manager (ACM) certificate.
* The load balancer's default DNS name is being used — public certificates cannot be issued for the \*.amazonaws.com domain.

This error occurs when the browser cannot verify a website's SSL certificate and is unable to establish a secure connection. It typically results from a misconfigured or incomplete certificate chain on the server.

Per MinIO docs:

* [https://min.io/docs/minio/linux/index.html](https://min.io/docs/minio/linux/index.html):

> While the port 9000 is used for connecting to the API, MinIO automatically redirects browser access to the MinIO Console.

* [https://min.io/docs/minio/linux/administration/minio-console.html#static-vs-dynamic-port-assignment](https://min.io/docs/minio/linux/administration/minio-console.html#static-vs-dynamic-port-assignment)

> respond to S3 API operations on the default MinIO server port :9000 and browser access on the MinIO Console port :9090

## **Resolution:**

In the **Host** field, replace the port number with **9000**:

**Step 1: Extract the private key and certificate body from the .pfx file**

If you need to obtain the private key and certificate body from a .pfx file, run the following commands:

```
openssl pkcs12 -in domino.p12 -nocerts -nodes -out privatekey.pem
openssl pkcs12 -in domino.p12 -clcerts -nokeys -out certificate.pem
```

The first command outputs the private key to privatekey.pem. The second outputs the certificate body to certificate.pem.

**Step 2: Convert the certificate chain file to PEM format**

Run the following command to convert the .p7b file to PEM format:

```
openssl pkcs7 -inform der -in DSNYCA_Chain-7-28-23.p7b -print_certs -out certificates.pem
```

This outputs the full certificate chain to certificates.pem.

**Step 3: Re-import the certificate into ACM**

1. Open the **AWS Certificate Manager (ACM)** console.
2. Locate the existing certificate and select **Reimport certificate**.
3. Paste the contents of certificates.pem into the **Certificate chain** field. Supply the certificate body and private key from Step 1 if prompted.
4. Complete the import.

## **Notes/Information:**

If changing the port to 9000 doesn't resolve the issue, please open a Support ticket and send in the following output for the datasource-proxy pod. This requires the Admin to have kubectl access:

1. Data Source Pod Status: kubectl -n `<platform-namespace>` get po --selector=app.kubernetes.io/name=datasource-proxy
2. Data Source Logs: kubectl -n `<platform-namespace>` logs --selector=app.kubernetes.io/name=datasource-proxy -c datasource-proxy
3. Data Source Proxy Pod describe: kubectl describe pod -n domino-platform `<datasource-proxy-name>`

Depending on the issue, Support may also ask for:

1. Data Source Proxy Deployment: kubectl get deployment -n domino-platform datasource-proxy -o yaml
2. Data Source Proxy Configure Map: kubectl get configmap -n domino-platform datasource-proxy -o yaml
3. Data Source Proxy Service: kubectl get service datasource-proxy -n domino-platform -o yaml

Since the certificate was originally imported into ACM manually, ACM provides the option to re-import it with an updated certificate chain.

### References/Internal Records:

* New York Dept-Sanitation Zendesk ticket #80270


## Related topics

- [Troubleshooting](/knowledge-base/troubleshooting-overview.md)
- [Connect to Generic S3](/cloud/platform-capabilities/core-concepts/data/data-source-connectors/connect-to-generic-s3.md)
- [Connect a Data Source](/cloud/platform-capabilities/features/monitoring/4-set-up-model-monitor/2-connect-a-data-source.md)
- [Connect to Amazon S3](/cloud/platform-capabilities/core-concepts/data/data-source-connectors/connect-to-amazon-s3.md)